Direct or Indirect, but Not Both
The most important concept in the Federal Cost Accounting Standards (CAS) is consistency. Do what you say you are going to do, and do it that way every single time. It’s a deceptively simple concept and violated more often than one might think. Simple to articulate, difficult to apply.
Case in point: Standard 402: “Consistency in Allocating Costs Incurred for the Same Purpose.” The fundamental requirement of CAS 402 is as follows:
All costs incurred for the same purpose, in like circumstances, are either direct costs only or indirect costs only with respect to final cost objectives. No final cost objective shall have allocated to it as an indirect cost any cost, if other costs incurred for the same purpose, in like circumstances, have been included as a direct cost of that or any other final cost objective. Further, no final cost objective shall have allocated to it as a direct cost any cost, if other costs incurred for the same purpose, in like circumstances, have been included in any indirect cost pool to be allocated to that or any other final cost objective.
And there you go. Costs must be either direct or indirect costs and, once a contractor determines which of its costs are direct and which are indirect, then all of those costs incurred for the same purpose, in similar circumstances, must be treated the same way—either direct or indirect. The contractor must be consistent in its cost accounting treatment, and the only loophole is that you can treat costs differently if the purpose and/or circumstances are different. Otherwise: consistency is the watchword.
The DCAA Contract Audit Manual contains several illustrations to help auditors distinguish cost accounting practices that are compliant with CAS 402 requirements from cost accounting practices that are not compliant. Here’s one that caught our eyes—
Problem. A contractor has a Government contract which requires extra effort for planning and cost management. It hired extra people to accomplish this effort and accounted for all their labor cost as a direct charge to the contract. The contractor has other people performing the same functions for more than one contract and their labor is charged to indirect costs.
Solution. Since the work being performed is the same and the only difference is in the amount of effort required to accomplish the function, this practice would not comply with the standard. The contractor could correct the situation by:
(1) charging all of these costs to indirect costs and developing an equitable distribution base or
(2) direct charging all of these costs.
We’ve encountered many upon many unintentional violations of CAS 402; some were trivial in amount (and consequences) and others not so much. Recently, government contractor Centerra Services International Inc., formerly known as Wackenhut Services LLC, seemingly ran afoul of CAS 402 and, as a result, had to pay $7.4 million to settle the resulting False Claims Act litigation.
According to the Department of Justice announcement—
Wackenhut provided U.S. military bases with firefighting and fire protection services under a subcontract with Kellogg Brown & Root Inc. (KBR), the prime contractor for the Army’s contract for logistical support in the military theater, known as LOGCAP III. LOGCAP III is the third generation of contracts under the Army’s Logistical Civil Augmentation Program. The government alleged that from 2008 to 2010, Wackenhut inflated its labor costs by billing the salaries of certain managers as direct costs under the subcontract, when those salaries had already been charged as indirect costs. The government further alleged that Wackenhut artificially inflated its labor rate by counting its costs for holidays, vacation, sick leave, rest and recuperation and other variable labor costs twice in calculating the rate. Wackenhut billed KBR, which then passed on the costs to the government under LOGCAP III.
While we don’t know any of the specifics of the allegations, it appears that Wackenhut (or Centerra Services, as the company is now called) decided to bill the labor associated with “certain managers” as direct costs, even though the salaries of those managers had been budgeted as indirect costs and included in the approved contract provisional billing rates as indirect costs. CAS 402 says you can’t do that. If you budget your managers’ salaries as indirect costs you have to treat those salaries as indirect costs on a consistent basis—even if “certain managers” supported the LOGCAP efforts on a full-time basis.
This CAS-based logic may seem counter-intuitive to some people. They might tend to think that if a cost can be identified to a project or contract (or “final cost objective” in CAS lingo) then it should be—or must be—a direct cost of that project or contract. But CAS says otherwise: CAS 402 says that if you identified that cost as an indirect cost, then it must always be treated as an indirect cost, even if it might be easy to treat it as a direct cost. As we noted, the only exception would be for a different purpose or different circumstances.
Indeed, if you were to go look at the very definition of “direct cost” in the FAR or in the CAS regulations, you would see that a direct cost is one that has been identified as a direct cost within the contractor’s accounting system—not one that could be identified as a direct cost. The distinction between those two concepts is crucial to CAS compliance.
The decision to make certain costs—or certain functions or activities—direct costs only or indirect costs only needs to be made with a lot of discussion and forethought, because once that decision is made it is very difficult to change. Typically, contentious discussions arise with respect to Security, Contracts, and similar functions. If the contractor states that Security is always an indirect function then, absent a different purpose or different circumstances, it must remain an indirect function—even if a Security person is assigned to an individual contract on a full-time basis.
CAS 402 means that if you decide that the cost of all personal computers is an indirect cost, then you cannot charge the cost of certain personal computers as a direct contract cost, even if you wouldn’t have purchased them absent the contract’s need for them.
CAS 402 means that if you decide that the salary costs of managers is an indirect cost, then you cannot charge the cost of certain managers as a direct contract cost if they are incurred in like circumstances. Because if you do so, you are violating the requirements of CAS 402 and you may find yourself in the midst of expensive False Claim Act litigation as a result.
How DOE Moves Forward without DCAA
It seems the past month – the first month of 2016 – has been devoted to discussing DCAA. It’s not that we have an obsession with the Defense Contract Audit Agency (though it’s entirely possible that we do have such an obsession); it’s more like those are the stories that compel us to sit down in front of keyboard and monitor and bang some words out. As we’ve noted before, we don’t write stories that don’t seem interesting to us. What’s going on with DCAA right now has caught our interest and thus the proliferation of articles.
Today’s article is more about the Department of Energy than DCAA, but we think it points to one means by which DOE is going to cope with the loss of DCAA audit services. The Department will have more than one strategy, to be sure. In fact, we heard from a local source that at least one large site in the Nuclear Complex is talking to independent auditors about filling the hole left by DCAA. But that’s not what this article is about.
Today’s article is about having Management & Operating (M&O) contractors perform audits of their subcontractors.
For those who may not know, M&O contracts – and associated M&O contractors – have been central to the DOE business model since just after World War II. The M&O contractors operate the large laboratories and nuclear complex sites that comprise large portions of the DOE mission and, as such the M&O contractors are essentially extensions of DOE management. In the words of one early report to Congress—
The working relationship between the Commission and its operating contractors resemble in some respects those between industrial companies and their branch offices. The contractor undertakes to carry on an extensive operation; the Commission establishes the objectives and makes the decisions required to fit the operation into the national program, and exercises the controls necessary to assure security, safety, desirable personnel administration, and prudent use of the public funds.
The DOE M&O contracts are relatively unique but the FAR recognizes them. Under the authority of FAR Subpart 17.6, the Department of Energy Acquisition Regulation (DEAR) has a Part 970 that supplements the FAR and governs the solicitation, award, and administration of DOE’s M&O contracts. Interestingly, DOE reports that “In addition, various other Federal agencies have at times recognized DOE’s ‘special relationship’ with its M&O contractors. Prior to enactment of the Competition in Contracting Act in 1984 … the Comptroller General asserted jurisdiction over protests against the award of subcontracts by DOE’s M&O contracts, a very limited instance of GAO’s assertion of protest jurisdiction over the award of subcontracts under a specific type of contract.”
As is relevant to this article, DOE relies “on the DOE Inspector General for auditing its M&O contractors [and] DOE requires the M&O contractor to maintain an internal audit function, which performs critical audit functions under DOE’s Cooperative Audit Strategy.” Thus, it can be seen that while the DOE IG audits the M&O contractors, those same M&O contractors are being required to audit their subcontractors as part of the “cooperative audit strategy.” In other words, DOE doesn’t need DCAA to audit a very large portion of its contract portfolio, because the agency holds the M&O contractors accountable for auditing their subcontractors and it relies on the IG to audit the M&O contractors.
A recent example of this evolution was provided by DOE IG audit report number OAI-V-16-03. That audit report reported on findings from the IG’s audit of Brookhaven National Laboratory, managed under an O&M contract by Brookhaven Science Associates LLC (“BSA”).
The audit report discusses DOE’s “cooperative audit strategy” with some detail, noting that—
The Department’s Office of Inspector General, Office of Acquisition Management, integrated management and operating contractors, and other select contractors have implemented a Cooperative Audit Strategy (Strategy) to make efficient use of available audit resources while ensuring that the Department’s contractors claim only allowable costs. This Strategy places reliance on the contractors’ internal audit function (Internal Audit) to provide audit coverage of the allowability of incurred costs claimed by contractors. Consistent with the Strategy, BSA is required by its prime contract to maintain an Internal Audit activity with the responsibility for conducting audits, including audits of the allowability of incurred costs. In addition, BSA is required to conduct or arrange for audits of its subcontractors when costs incurred are a factor in determining the amount payable to a subcontractor.
Basically, then, the DOE IG audits the work performed by the M&O Internal Audit function, which is responsible for auditing the M&O contractor’s claimed costs as well as the claimed costs by the contractor’s “flexibly priced” subcontractors.
In this case, the DOE IG found nothing with respect to the audits of BSA’s claimed costs. Per the audit report—
Based on our assessment, nothing came to our attention to indicate that the allowable cost–related audit work performed by BSA’s Internal Audit could not be relied upon. We did not identify any material internal control weaknesses with cost allowability audits, which generally met the International Standards for the Professional Practice of Internal Auditing (Standards) prescribed by the Institute of Internal Auditors (IIA). BSA’s Internal Audit identified $1,027,133.24 of questioned costs during FYs 2012 and 2013, all of which had been resolved.
However, the IG found two issues with respect to BSA’s audits of its subcontractor’s claimed costs. The IG found that (1) BSA was not performing “interim audits” of flexibly priced subcontracts, and (2) BSA was not performing any audits whatsoever on its time-and-materials (T&M) type subcontracts.
With respect to Finding No. 1, in fact BSA did perform reviews of interim vouchers submitted by its subcontractors, in order to detect unallowable costs and prevent them from being paid. However, the IG found that approach was insufficient to meet requirements. The IG emphasized that subcontractor audits “at a minimum” should meet IIA standards. Neither the personnel performing the voucher reviews nor the procedures being performed met those standards. BSA concurred that invoice reviews were not “audits” and that audits would be performed on “higher-risk” subcontracts.
With respect to Finding No. 2, the IG audit report stated—
A BSA official initially stated that time-and-materials subcontracts were not audited because they were considered low risk, as they have fully negotiated labor rates and the hours utilized were reviewed for technical sufficiency. However, time-and-materials subcontracts often include variable costs, such as materials and travel, which should still be audited. In a subsequent discussion, other BSA officials acknowledged that time-and-materials subcontracts should have been considered for audit because these types of subcontracts have attributes of cost-type subcontracts. We were informed that BSA plans to include time-and-materials subcontracts in future audit universes.
So this may be the future in a world where DCAA no longer performs audits. The non-DoD Federal agencies will pay their big prime contractors to perform the audits that DCAA no longer performs, and will hold them to similar standards. (Though of course the IIA standards are not the same as GAGAS.) The prime contractors will hire auditors, develop procedures, and implement them—and then bill the Federal agencies for the effort expended in doing so.
And as we noted, while DOE is holding its M&O contractors accountable for performing audits on their subcontractors, we are told the agency is talking to independent CPA firms to cover the rest of its contracts.
Is this the model of the future? Obviously we don’t know for sure, but it seems to be working for the Department of Energy.
|
DCAA Reorganizes to Rebalance its Workload
Much has been written, here and elsewhere, about recent changes to DCAA’s workload. If you don’t know what we’re talking about, please visit the News Archive over there on the left side of our website’s front page, and take a look through the recent articles on the topic.
Suffice to say, DCAA leadership has a lot to deal with these days—and to deal with it they have decided to significantly reorganize the audit agency.
More than one source provided us with purported internal communications on the topic, including maps and org charts – so we’re going with this story as being confirmed and accurate. If you know anything different, send us an email and we’ll correct any mistakes.
From those internal communications, we learned that DCAA is embracing the “CAC Network” concept at all of the largest defense contractors. The “CAC Network” approach is not new: it was first introduced by then-Director Pat Fitzgerald in 2011. The concept envisions a coordinated and communicative network of auditors, all of whom focus on one single contractor and all of whom are under the direction of a single audit leader. It was first piloted at Raytheon, where it seemingly worked well for DCAA and DCMA. Challenges included negotiating with the union to break auditors out of local union siloes and negotiating with Field Detachment regarding its proper role within the CAC Network. DCAA overcame those challenges and is moving the concept to other contractors, including General Dynamics, BAE, Northrop Grumman, Lockheed Martin, Boeing, and Honeywell. All auditors associated with each of those contractors will report into the CAC Network, which will be managed in single offices. (As a side note, L-3 Communications is going to have its own CAC Network, managed entirely by Field Detachment. Good luck with that.)
The thing of it is, the CAC Network concept is not particularly new news and most of the contractors listed above have been identified before as being candidates for implementation. Indeed, in the 2012 Annual Report, Northrop Grumman was identified as being next in line after Raytheon. That was literally four years ago. That said, the more widespread implementation of the CAC Network is the official reason for the workload “rebalancing” that requires such a significant agency reorganization.
And what is that reorganization?
In the words of Ms. Bales—
The result [of the reorganization] is 3 regions—Eastern in Atlanta, Central in Dallas, and Western in Los Angeles. The physical size of the regions has increased significantly, and the boundaries may appear awkward compared to our current regional structure. While we now have a more evenly balanced workload among the regions, the workload distribution does not fall neatly along geographical lines. … Our customers will get the benefits of the new structure without being affected by the physical regional boundaries.
Ms. Bales wasn’t kidding when she stated that the three new regions look “awkward” when compared to the way it used to be. For example, the new Western Region stretches from Alaska and Hawaii to Arkansas—and apparently includes South Asia as well. The new Western Region encompasses 24 of the 50 states. In contrast, the new Eastern Region stretches from Maine to Georgia and seems to include Europe and North Asia. And the new Central Region encompasses 13 states (including Florida), and also includes Puerto Rico. So yeah, awkward. But it must make sense to the folks in Ft. Belvoir.
Regional Audit Manager (RAM) assignments may be a more telling indication of the workload/audit volume between the three Regions. There are eight (8) RAM assignments in the Western Region, ten (10) RAM assignments in the Eastern Region, and eight (8) in the Central Region. (FD has 5 RAM assignments.) Interestingly, two of the eight Western Region RAM positions are shown as being vacant, meaning there are promotion opportunities available.
What happened to the Mid-Atlantic Region? It’s gone. Disappeared. It no longer exists. And that means the Mid-Atlantic Compensation Team no longer exists as well. Our understanding is that at least one other Region is standing up its own Compensation Team to meet the needs of the Incurred Cost audit teams.
Importantly, the new CAC Network leaders (Directors?) report directly to Ms. Bales and not to the Regional Directors (with the possible exception of the L-3 CAC Network leader, who may report directly to Ms. Cash, Field Detachment Director). There are three RAMS in the GD/Raytheon/BAE CAC Network (reporting to Lowell, MA). There are three RAMS in the Lockheed Martin CAC Network (reporting to Fort Worth, TX). There are three RAMS in the Boeing/Honeywell Network (reporting to St. Louis, MO). And there are two RAMS in the Northrop Grumman Network (reporting to Falls Church, VA).
For those readers who may be wondering which Region their cognizant Field Audit Office (FAO) reports into, DCAA prepared several slides to answer that question. Basically, it’s as you would expect. If you are in one of Western Region states, your FAO very likely reports into the Western Region (even if it previously reported into the Central Region). Ditto for the Central and Eastern Regions.
We have asked our technologist and web master to post the documents we received to our website. They should go up soon. If you are a member, you can access them. If you are not a member, you are out of luck.
As a reminder, membership is not a big deal. Membership is free. Apogee Consulting, Inc. does not sell membership information to anybody. Apogee Consulting, Inc. does not use membership information for any commercial purposes. Instead, membership is simply an acknowledgement of commitment to following the information we provide, on the blog and elsewhere on the site. If you are not willing to commit to a free membership then you cannot access the resources available on the site.
Will the reorganization help DCAA with its perceived productivity problems? We’ll have to wait to see. But one thing is for sure: it’s the biggest shakeup to impact DCAA in quite a while.
What is a Compensation System?
Back in the “old days” before Congress and DoD significantly revised the standards for contractor internal controls, there were ten (10) internal control “systems” that contractors were supposed to establish and maintain. To be clear, not all ten systems applied to every contractor; as contractors grew they became subject to new system requirements. The larger the contractor, the more robust and sophisticated its internal controls were supposed to be.
Back in the “old days” DCAA maintained audit programs for each system, along with “matrices” that established expected control objectives, control activities, and the audit procedures that would be used to test them. To be clear (again), these systems were (by and large) not regulatory requirements; except for the more fundamental systems (e.g., estimating, purchasing, government property control), they were not to be found in contract clauses. The ten systems, the control objectives, and the control activities largely were based on DCAA’s own notions regarding what control systems DoD contractors should have.
Yet there was nothing else upon which to base an internal control environment. For better or worse, DCAA’s notions became the de rigueur standard for contractors. And it wasn’t just defense contractors that adopted them; the DCAA notions of internal control adequacy became the sine qua non for every single government contractor. Perhaps the original impetus for the widespread adoption of DCAA's standards came from the fact that DCAA auditors performed audits for agencies other than DoD on a reimbursable basis—including DOE and NASA, to name two major agencies—and thus by default those non-DoD agencies adopted DCAA’s standards. But we think the more salient fact is that there was simply nothing else available. DCAA’s standards were the only game in town.
But that all changed in early 2012 with the promulgation of the “contractor business systems” management and oversight regime. By public law and DFARS rule-making, six contractor business systems were defined, along with associated system adequacy criteria. DCAA audit programs related to areas outside those six systems were retired, and audit programs for those six systems were substantially revised. Internal control matrices related to the old “ICAPs” were retired, and internal control matrices for the six systems were changed to tie to the new official adequacy criteria. It was a sea-change, a revolution in how defense contractors were going to manage their operations. It was the new thing.
Non-DoD agencies were in a quandary, because the six business systems were exclusively the province of DFARS and defense contractors. For example, there were no DOE contract clauses similar to the DFARS contract clause 252.242.7005 (“Contractor Business Systems”). Thus, the actions of the DAR Council created two distinct and separate approaches to contractor internal control: one for defense contractors and another for contractors doing work for civilian agencies.
That wasn’t a terrible thing if you knew which agency you were supporting. But for the many contractors that held contracts with both DoD and non-DoD agencies, it was confusing, to say the least.
To a large extent, DOE solved the problem by adopting an approach that was very similar to the DoD regime. That certainly made things easier for the DCAA auditors performing reimbursable work for DOE! (Not to mention clarifying things for DOE contractors.) However, that approach also resulted in an unforeseen challenge when DCAA cut back on the amount of audits it performed for DOE. It didn’t matter which internal control regime was in place, when nobody was checking to see if contractors were following it.
And that audit challenge was exacerbated when the 2016 National Defense Authorization Act (NDAA) included an express prohibition on DCAA performing audit services for non-DoD agencies. Not only was the DCAA audit coverage of DOE contractors being significantly eroded over time (because of changes to DCAA’s “risk-based” audit procedures); but now Congress had effectively reduced it to zero.
It doesn’t matter whether or not DOE adopts the DFARS business system management regime if there are no auditors available to enforce it.
One of the actions that DOE has taken to address its sudden shortfall of audit coverage is to reduce the requirement for audits. For instance, it is officially reducing the need to approve DOE contractors’ compensation systems on an individual contract (or contractor) basis. The fewer contractors that have to have their compensation systems reviewed and approved, the fewer reviews that will need to be performed.
Or in the words of the DOE Acquisition Letter (AL-2016-01)—
DOE Order 350.1 establishes the responsibilities, requirements, and cost allowability criteria for the management and oversight of contractor human resource programs. The Order establishes oversight responsibilities to ensure DOE contractors manage their human resource programs to support the DOE mission, promote work force excellence, champion work force diversity, achieve effective cost management performance, and comply with applicable laws and regulations. Chapter IV, Compensation; Chapter V, Benefits; and Chapter VI, DOE Contractor Pension Plans, establish oversight responsibilities to promote reasonable contractor compensation and benefits in accordance with the Federal Acquisition Regulation’s (FAR) cost principles (FAR Part 31). DOE has determined that a risk-based approach, rather than a transactional approach, is appropriate to promote cost reasonableness in accordance with the referenced FAR cost principles.
Thus—
The purpose of Acquisition Letter (AL) 2016-01 is to provide guidance regarding required actions to move from DOE traditional transactional approach for approving certain costs relating to compensation and benefits, to a risk based approach that removes a requirement for DOE approval where risk reducing conditions are met.
To implement the new approach, DOE has issued a new Section H clause to be “bilaterally” incorporated into the following contract actions:
M&O and non-M&O cost reimbursement solicitations and contracts where work had been previously performed under a DOE M&O contract and the successor Contractor is (a) required to employ all or part of the former Contractor’s workforce and sponsors the employee pension and benefit plans; or (b) retains sponsorship of benefit plans that survive performance of the contract work scope. Contracts in this latter category include, but are not limited to, environmental remediation, infrastructure services and other site-specific project completion contracts.
The new Section H provision/clause defines the type of information that an affected DOE contractor must submit for review. The information includes:
-
Philosophy and strategy for all pay delivery programs.
-
System for establishing a job worth hierarchy.
-
Method for relating internal job worth hierarchy to external market.
-
System that links individual and/or group performance to compensation decisions.
-
Method for planning and monitoring the expenditure of funds.
-
Method for ensuring compliance with applicable laws and regulations.
-
System for communicating the programs to employees.
-
System for internal controls and self-assessment.
-
System to ensure that reimbursement of compensation, including stipends, for employees who are on joint appointments with a parent or other organization shall be on a pro-rated basis
In addition to the foregoing, DOE contractors subject to the new provision/clause must—
… develop, implement and maintain formal policies, practices and procedures to be used in the administration of its compensation system consistent with FAR 31.205-6 and DEAR 970.3102-05-6; “Compensation for Personal Services”. DOE-approved standards (e.g., set forth in an advance understanding or appendix), if any, shall be applied to the Total Compensation System. The Contractor’s Total Compensation System shall be fully documented, consistently applied, and acceptable to the Contracting Officer. Costs incurred in implementing the Total Compensation System shall be consistent with the Contractor's documented Contractor Employee Compensation Plan as approved by the Contracting Officer
But that’s not all. Contractors that have the new Section H clause in their contracts (or agree to have their contracts modified to include the new clause) must also submit to their cognizant Contracting Officer the following information—
-
An Annual Contractor Salary-Wage Increase Expenditure Report to include, at a minimum, breakouts for merit, promotion, variable pay, special adjustments, and structure movements for each pay structure showing actual against approved amounts; and planned distribution of funds for the following year.
-
A list of the top five most highly compensated executives as defined in FAR 31.205-6(p)(4)(ii) and their total cash compensation at the time of Contract award, and at the time of any subsequent change to their total cash compensation. This should be the same information provided to the System for Award Management (SAM) per FAR 52.204-10.
There’s more to it than that, of course. (Pages and pages of detail, actually.) But the foregoing provides the basic compliance requirements. In return for agreeing to the clause requirements, DOE contractors (presumably) won’t need to have their compensation systems reviewed by auditors and approved by Contracting Officers.
Not addressed in the DOE Acquisition Letter is what the DOE Contracting Officers will actually do with all the detailed information they receive from their contractors. They are going to be inundated with compensation and HR and pension data; who is going to review it? Who will evaluate it for acceptability? What if it is not acceptable—what happens then? We did not see the answers to those questions in the DOE policy guidance.
If there is no ability to actually evaluate the information received, to determine whether or not the contractor’s compensation system is low-risk, then the result of the new clause is to create the illusion of management oversight and control where none actually exists. In our view, that’s really not a good thing for taxpayers.
Also not addressed is what kind of compensation system a contractor needs if it neither sells to DOE or to DoD. For example, what kind of compensation system is required of a contractor that provides services solely to the Environmental Protection Agency? We don’t know.
For those contractors that fall outside of current regulatory or contractual coverage, or for those contractors that are small businesses and hope to grow into a large business one day, there is precious little guidance available to assist them in this area. The only guidance we would recommend is the DCAA control matrix related to the compensation internal control system, the "ICAPs" internal control matrix that existed before the DFARS contractor business system changes were promulgated.
But where do you find that retired document?
We don’t think you can find that information on the current DCAA website, but it might be available via Google archive or similar data-mining efforts. Or you can ask your local DCAA auditors to see if they can find it. Or maybe your compliance folks retained a copy.
We did.
|